APS/123-QED 



A quantum key distribution and identification protocol 
based on entanglement swapping 

Fei Gao^'^ Fenzhuo Guo^ Qiaoyan Wen^ and Fuchen Zhu'^ 
(1. School of Science, Beijing University of Posts and Telecommunications, Beijing, 100876, China) 
(2. State Key Laboratory of Integrated Services Network, Xidian University, Xi'an, 710071, China) 
(3. National Laboratory for Modern Communications, P.O.Box 810, Chengdu, 610041, China) 

Email: hzpe@sohu.com 
(Dated: February 1, 2008) 

A quantum key distribution and identification protocol is proposed, which is based on entan- 
glement swapping. Through choosing particles by twos from the sequence and performing Bell 
measurements, two communicators can detect eavesdropping, identify each other and obtain the 
secure key according to the measurement results. Because the two particles measured together are 
selected out randomly, we need neither alternative measurements nor rotation of the Bell states. 
Furthermore, less Bell measurements are needed in our protocol than in the previous similar ones. 
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I. INTRODUCTION 

As a kind of important resource, entanglement JlJ is 
widely used in the research of quantum information, in- 
cluding quantum communication, quantum cryptogra- 
phy and quantum computation. Entanglement swapping 
[21, abbreviated by ES, is a nice property of entangle- 
ment. That is, by appropriate Bell measurements entan- 
glement can be swapped between different particles. For 
example, consider two pairs of particles in the state of 
|$+),equivalently,|$+)i2 = |$+)34 = 1/V2(|00) + |11», 
where the subscripts denote different particles. If we 
make a Bell measurement on 1 and 3, they will be en- 
tangled to one of the Bell states. Simultaneously, 2 and 
4 will be also projected onto a corresponding Bell state. 
We can find the possible results through the following 
process: 

|*+)l2 ® |$ + )34 = ^(|00) + |ll))i2 ® (|00) + |11))34 

= ^(10000) + 10101) + IIGIG) + |llll))i324 

= ^(1*+*+) + I*"*") + + + ) + |«'"*"))l324 (1) 

It can be seen that there are four possible re- 
sults: |$+)l3|$+)24, |*-)l3|$-)24, |*+)l3|* + )24 and 

I^~)i3|^~)24- Furthermore, these results appear with 
equal probability, that is, 1/4. For further discussion 
about ES, see 1111,1113. 

Quantum cryptography is the combination of quan- 
tum mechanics and cryptography. It employs fundamen- 
tal theory in quantum mechanics to obtain unconditional 
security. Quantum key distribution (QKD) is an impor- 
tant research direction in quantum cryptography. Ben- 
nett and Brassard came up with the first QKD protocol 
(BB84 protocol) in 1984 '7'|. Afterwards, many protocols 
were presented 8, 9, 10, n.,i2,I3,14_15,^16,,17, 18J. Re- 
cently, several QKD schemes based on ES were proposed 
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duced a protocol without alternative measurements. It 
was simplified and generalized before long, and 
its security was proved in [23|. Besides, Zhao et al. pre- 
sented a protocol using ES on doubly entangled photon 
pairs psj . 

In this paper we propose a QKD protocol based on ES, 
which needs neither alternative measurements '25^ nor 
rotation of the Bell states 2^ ■ Simultaneously, 

we also use ES to identify the legal users. The security 
against the attack discussed in ^(T| is assured by certain 
classical means. See Sec. II for the details of this protocol. 
The security is analyzed in Sec. Ill and a conclusion is 
given in Sec.IV. 



II. THE QKD AND IDENTIFICATION 
PROTOCOL 

Suppose the two legal communicators, AHce and Bob, 
share a bit string /£), which is used to identify each other. 
The initial ID can be obtained by the means discussed in 
[2^ . The particular process of this scheme is as follows: 

1. Prepare the particles. Alice generates a sequence of 
EPR pairs in the state \^+)ab = 1/V2(|G0) + |ll)).For 
each pair, Alice stores one particle and sends the other 
to Bob. 

2. Detect eavesdropping. 

(1) Having received all the particles from Alice, Bob 
randomly selects a set of particles out and makes Bell 
measurements on them by twos. 

(2) Bob tells Alice the sequence numbers and measure- 
ment results of the pairs he measured. 

(3) According to the sequence numbers, Alice performs 
Bell measurements on the corresponding pairs, and com- 
pares her results with Bob's. For example, consider one of 
the pairs Bob measured, in which the sequence numbers 
of the two particles are m and n. Then Alice measures 
her m-th and n-th particles in Bell basis, and compares 
the two results. As discussed in Sec. I, if these particles 
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were not eavesdropped, Alice and Bob should obtain the 
same results. Otherwise there must be an eavesdropper 
(Eve) in the channel, Alice will abort this communica- 
tion. 

3. Identify the users. 

(1) Bob randomly selects a set of particles out from 
his left sequence, and divides them into two subsets av- 
eragely, which are denoted as Si and 5*2, respectively. 

(2) Bob makes Bell measurements on the particles in 5'i 
by twos. Note that for each pair there are two sequence 
numbers (because each particle has a sequence number) 
and one corresponding measurement result. Here two 
notations. Pi and Ri , are introduced to denote all the 
sequence numbers and all the corresponding results, re- 
spectively. By the same means. Bob measures the parti- 
cles in 5*2 . Similarly, the sequence numbers are denoted 
as P2 and the corresponding results as R2 ■ 

(3) Taking the shared information ID as the key. Bob 
encrypts Pi, Ri and P2 with the one-time-pad cipher: 
y — Eid{Pi, Ri, P2) , and sends y to Ahce through the 
classical channel. 

(4) When Alice received the ciphertext y, she decrypts 
it with the help of ID: P{,R[,P^ = EJj^iy) ■ According 
to P{ , Alice measures the corresponding particles in Bell 
basis and compares her results with R'l . If both results 
coincide, Alice considers Bob is legal and the communi- 
cation continues. 

(5) According to i Alice measures the corresponding 
particles in Bell basis and sends the measurement results 
(denoted as R2 ) to Bob through the classical channel. 

(6) Bob compares R2 with R2 . If they are identical. 
Bob considers Alice is legal. Otherwise, he stops this 
communication. 

4. Obtain the key. Bob makes Bell measurements on 
his left particles by twos. It should be emphasized that 
each pair he measures is selected out randomly. Bob 
records the sequence numbers of all the pairs and sends 
the record to Alice. Alice then measures her correspond- 
ing particles in Bell basis. As discussed in the above 
paragraphs, their measurement results would be identi- 
cal. Subsequently, Alice and Bob can obtain the key from 
these results. For example, 1$+), |$^), |*+) and |*^) 
are encoded into 00, 01, 10 and 11, respectively. 

5. Renew ID. Alice and Bob cut a little part from 
the key to "refuel" the shared information ID and the 
previous one is discarded. 

Thus the whole QKD and identification protocol is fin- 
ished. By this process, Alice and Bob can not only get 
secure key but also identify each other. 



III. SECURITY 

The above scheme can be regarded as secure. The 
reasons are as follows: 

1. Each user's identity is authenticated and it is impos- 
sible for Eve to impersonate Alice (or Bob) and distribute 



key with Bob (or Alice). In this protocol the shared in- 
formation ID is only known to Alice and Bob. If Eve 
wants to impersonate Alice, she can not decrypt y cor- 
rectly and get P2 in step. 3. Consequently Eve can not 
present R2 with which Bob is satisfied. On the contrary, 
if Eve wants to impersonate Bob, she will be detected, 
too. Because Eve can not give such a "ciphertext" that 
Alice would obtain suited Pi and Pi after she used ID 
to "decrypt" this "ciphertext". Furthermore, Eve can 
not obtain ID from the qubits and the classical infor- 
mation transmitted. Because ID is used as a key of the 
one-time-pad cipher to encrypt some random bit strings 
including Pi , Pi and P2 , Eve can not extract any infor- 
mation about ID, even through repeated attempts. In 
addition, it makes the protocol more secure that Alice 
and Bob would renew ID when they get the key. 

2. The key distributed can not be eavesdropped imper- 
ceptively. There are two general eavesdropping strategies 
for Eve. One is called "intercept and resend" , that is. Eve 
intercepts the legal particles and replaces them by her 
counterfeit ones. For example. Eve generates the same 
EPR pairs and sends one particle from each pair to Bob, 
thus she can judge Bob's measurement results as Alice 
does in step. 4. But in this case there are no correlations 
between Alice's particles and the counterfeit ones. Al- 
ice and Bob will get random measurement results when 
they detect eavesdropping in step. 2. Suppose both Alice 
and Bob use s pairs particles to detect eavesdropping, 
the probability with which they obtain the same results 
is only (1/4)* . That is. Eve will be detected with high 
probability when s is big enough. The second strategy 
for Eve is to entangle an ancilla with the two-particle 
state that Alice and Bob are using. At some later time 
she can measure the ancilla to gain information about the 
measurement results of Bob. This kind of attack seems 
to be stronger than the first strategy. However, we can 
prove that it is invalid to our protocol as follows. 

Because each particle transmitted in the channel is in 
a maximal mixed state, there are no differences among 
all these particles for Eve. Furthermore, Eve does not 
know Bob will put which two particles together to make 
a Bell measurement. As a result, what she can do is to 
make the same operation on each particle transmitted. 
Let \ip)abe denote the state of the two particles and the 
ancilla, where the subscripts A, B and E express the 
particles belonging to Alice, Bob and Eve, respectively. 
Note that we do not limit each ancilla's dimension, and 
allow Eve to build all devices that are allowed by the 
laws of quantum mechanics. What we wish to show is 
that if this entanglement introduces no errors into the 
QKD procedure, then \lp)abe must be a product of a 
two-particle state and the ancilla. This implies that Eve 
will gain no information about the key by observing the 
ancilla or, conversely, if Eve is to gain information about 
the key, she must invariably introduce errors. 

Without loss of generality, suppose the Schmidt de- 
composition |27j | of \ f)ABE is in the form 



3 



in which bpq {p, q = 1,2, 3, 4) are complex numbers. Then 
\<f)ABE can be written, thanks to Eqs.(2) and (3), as 

\v)aBE = ai\lpi) ab\(I)i) E + a2\tp2)AB\<l>2)E 

+a3\tlJ3) AB\(t>3) E + a4\'ip4) Ab\^4) E (2) 

where and \(f)j} are two sots of orthonomal states, Uk 
are non-negative real numbers {i,j, fc = 1, 2, 3, 4 ). 

Because \4>i) are two-particle (four-dimensional) states, 
they can be written as linear combinations of |00), |01), 
|10) and 111). Let 

IV'i) - him + ^i2|01) + 5i3|10) + 5i4|ll) 

IV'2) = &2l|00) + 622IOI) + 623IIO) + 624III) 

iV'3) = b^im + 632I01) + 633I10) + 634I11) 

IV4) = 641IOO) + 642IOI) + 643IIO) + 644III) (3) 



\<f)ABE = |00)^B (ai^ii|<?^'i) + a2b2i\4>2) + asbsilcps) + 04641 |<?^'4))_e 
+|01)^B O {aibi2\(f>i) + a2b22\^2) + a3b32\^3) + 046421 <?f'4))B 

+ |10)aB {aibi-i\(f>i) + a2623l<^2) + a3633l<^3) + a4643l'/>4))B 

+ |11)ab ® (ai6i4|(/)i) + a2b24\4'2) + a3b34\4'3) + a4644|<^4))ii; (4) 



For convenience, we define four vectors (not quantum 
states) as follows: 

vi = {aibu,a2b2i,a3b3i,a4b4i) / = 1,2,3,4 (5) 

Consider any two sets of particles on which Alice and Bob 
will do ES, the state of the system is |<^)abb |<^)abb- 

I 



However, this event should not occur. In fact, if Eve 
wants to escape from the detection of Alice and Bob, 
any results-pair other than ^+^+ and 

^f^^f^ should not be appear. Let P($^^^) = , we 
then have, from Eqs.(7) and (5), 

vfv2 + V2V1 + ujti4 + vjv3 = (8) 

in which vf is the transpose of vi . 

Similarly, let the probabilities of ^'^^E'b and 



I 

According to the properties of ES, we can calculate 

the probability with which each possible measurement- 
results-pair is obtained after Alice and Bob measured 
their particles in Bell basis. For example, observe the 
event that Alice gets 1$"*") and Bob gets \^~^) , which 
corresponds to the following item in the expansion: 



(6) 



(7) 



^A^B equal to 0, we get 

vfv2 - V^Vi + v'^V4 - vjv3 = (9) 



w^W2 + vjvi — v^Va — vjv^ = (10) 



rj-r rri rri rri 

Vl V2 — V2V1 — Ug V4 + V^V3 = (11) 



|*+)a|*+)b 



{arbriaabs2 + arbr2asbsl + arbr3asbsA + arbr4asbs3)\(l>r(l>s)E 



.r,s=l 



Therefore, this event occurs with the probability 
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P{<^\^y) = T ^ \arbriasbs2 + arbr2asbsl + arbr3asbs4 + arbr4asbs3\ 
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From Eqs.(8)-(11), we can obtain 



rri rrt rj-\ rj-i 

"2 = v^vi = V4 — v^^vs — (12) 



That is, 



Vi = or V2 = 
W3 = or V/^ — 



(13) 



For the same reason, we can obtain the following results: 
(1). Let the probabilities of '^^^g, *A*i3' ^^'^ 
'^A^B equal to 0, we can get 



vi = or V3 = 
V2 = or ■i;4 = 



(14) 



(2). Let the probabilities of ^^"^ ^a^b equal to 

0, we then have 



r-j-r rr^ rj-i rj-i 

Vi vi — V2V2+ — W4 W4 = 



ViVi + V2V2 — wjw3 — vjvi — 



And then 



Vi = ±W4 
V2 = ±V3 



(15) 



(16) 



(17) 



(3). Let the probabilities of ^'J^^E'^ and ^'^^^ equal to 
0, we can get the same conclusion as Eq.(17). 

Finally, we can obtain three results from Eqs.(13), (14) 
and (17): 

1. vi = V2 = V3 = Vi = ; 

2. I'l = I'i = and V2 = ±^3; 

3. V2 — — and vi — zLv4 

That is, each of these results makes Eve succeed in escap- 
ing the detection of Alice and Bob. Now we can observe 
what the state \ f)ABE is by putting these results into 
Eq.(4). If the first result holds, we have \(p)abe = 0, 
which is meaningless for our analysis. Consider the con- 
dition where the second result holds, \ip)ABE can be writ- 
ten as: 



\^)abe = (|01) ± \1Q))ab ® {aibi2\(l>i) + 

a2&22|02) +036321(^3) + aib42\4>4)) E 



It can be seen that \(p)abe is a product of a two-particle 
state and the ancilla. That is, there is no entanglement 
between Eve's ancilla and the legal particles, and Eve can 
obtain no information about the key. Similarly, we can 
draw the same conclusion when the third result holds. 

To sum up, our protocol can resist the entangle-ancilla 
eavesdropping strategy. 

IV. CONCLUSION 



We have presented a QKD and identification protocol 
based on ES. The security against the attack discussed in 
|20j | is assured by a classical means, "randomly select the 
particles out and put together by twos" , in stead of the 
quantum ones such as alternative measurements |25l | or 
rotation of the Bell states [2lll2^l23| . Furthermore, this 
classical means brings us another advantage. That is, it 
is unnecessary to randomize the initial Bell states as in 
[T^ I21I I . This in turn leads to less Bell measurements in 
our protocol. For instance, to distribute two bits of key, 
Alice and Bob make two Bell measurements in our proto- 
col, while in [l^l2ll | they must make three. Therefore, we 
can draw a conclusion that classical means is important 
to the research of quantum cryptography and to some 
extent it is even more effective than the quantum ones. 
Besides, classical means is easier to be implemented. On 
the other hand, we have to confess that our protocol has 
a disadvantage, i.e., it uses a sequence of entangled states 
but not a single quantum system |^ to generate 

the key. Fortunately, it is not a fatal problem. Many 
QKD protocols work in this model, for example, the fa- 
mous E91 protocol Q. Furthermore, each pair of parti- 
cles is still in one of the Bell states and can be reused in 
other applications after QKD. 
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